MalwareEducationEducationRansomwareSupply Chain (3P Vendor)Data ExfiltratedRansom DemandedRansom PaidCustomer Data InvolvedEmployee Data InvolvedGovernment IDIdentity (basic)MediumContained

The Athenian School

bd_ee7804c9cebc5b21 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Oct 27, 2020

To disclose

—

Affected

Not disclosed

Confidence

65%

Full breach record for The Athenian School →

Athenian School notified the California AG of a ransomware attack on its third-party vendor, Blackbaud, occurring between Feb 7 and May 20, 2020. Cybercriminals exfiltrated backup files containing personal information, including Social Security numbers and tax identification numbers, of alumni and vendors. Blackbaud paid the ransom and claimed data destruction, but later confirmed some data was unencrypted. Athenian offered 24 months of credit monitoring and updated data storage policies.

J jump to incidentP pin to compareR raw source

Incident timeline

Feb 7, 2020

Begins

Oct 27, 2020

Filed

Part of BLACKBAUD, INC. supply-chain incident (2020) — a supply-chain cascade affecting multiple organizations.View cascade →

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: The Athenian School
norm: the athenian school
Domain: athenian.org

Name: The Athenian School
norm: the athenian school
Domain: athenian.org
Industry: Educationllm

Discovered: —
Breach occurred: Feb 7, 2020 – May 20, 2020
Materiality determined: —
Notification sent: Sep 29, 2020
Affected individuals: Not disclosed
Data types: Government IDIdentity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Third party: via Blackbaud
Initial access: supply_chain

During the incident: Engaged independent forensics experts
Cooperated with law enforcement
Offering Identity Theft Protection services to individuals whose social security numbers were exposed at no cost
Provided 24 months of credit monitoring through CyberScout
Changes made: Instituted a policy of not storing vendors’ social security numbers in Blackbaud’s systems
Blackbaud intends to encrypt all social security number data in its database
Blackbaud intends to delete the old, unused data
Athenian will store tax identification numbers in internal file repositories that contain their own encryptions and are also stored behind a firewall
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-195583
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 27, 2020
Raw hash: 30a6fd87c98611a629c0e04718488b7f79cdb6f33d051a11358ce8c3255c0db4

Reporting entityThe Athenian School

Victim entityThe Athenian School

IncidentThird-Party / Supply Chain

Stated responseEngaged independent forensics experts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov